Hacker News Reader

As a Canadian, using a Canadian ISP, I would like to know as well.

Not entirely surprised regarding rogue employee possibility.

There are two things at play here: attacker has to have access to one ISP to inject the route (eg. rogue employee) and there has to be another ISP that accepts such route from BGP (I would say that filtering weirdly specific routes is good and common practice). When you have access to ISP network you don't have to inject things into BGP to attack your own customers.

A /24 is not a 'weirdly specific route'. I agree, that the upstream should have been filtering things, but you can't expect them to just filter out all the /24's.

For example, Google DNS anycast would stop working: http://bgp.he.net/net/8.8.8.0/24 as would basically anyone else doing anycast.

NANOG post from this morning has the AS path:

http://mailman.nanog.org/pipermail/nanog/2014-August/069131....

I'm unsure exactly which was originating the route.

"the CTU research team provided the BGP evidence to the upstream ISP closest to the origin of the malicious activity."

I think this likely means it's a smaller ISP.

Jack Bauer will take good care of this issue